{"record":{"id":"ebb827bfdd510fc8","repo":"quarkusio/quarkus","slug":"authorizationpolicy-annotation-placed-on-resource","errorCode":null,"errorMessage":"@AuthorizationPolicy annotation placed on resource method '${className}#${methodName}' wasn't detected by Quarkus during the build time. Please consult https://quarkus.io/guides/cdi-reference#bean_discovery on how to make the module containing the code discoverable by Quarkus.","messagePattern":"@AuthorizationPolicy annotation placed on resource method '(.+?)#(.+?)' wasn't detected by Quarkus during the build time\\. Please consult https://quarkus\\.io/guides/cdi-reference#bean_discovery on how to make the module containing the code discoverable by Quarkus\\.","errorType":"exception","errorClass":"IllegalStateException","httpStatus":null,"severity":"error","filePath":"extensions/resteasy-reactive/rest/runtime/src/main/java/io/quarkus/resteasy/reactive/server/runtime/security/EagerSecurityHandler.java","lineNumber":210,"sourceCode":"            }\n            return List.of();\n        }\n    }\n\n    public static final class AuthZPolicyCustomizer implements HandlerChainCustomizer {\n        @Override\n        public List<ServerRestHandler> handlers(Phase phase, ResourceClass resourceClass,\n                ServerResourceMethod serverResourceMethod) {\n            if (phase == Phase.AFTER_MATCH) {\n                var desc = ResourceMethodDescription.of(serverResourceMethod);\n                var authorizationPolicyStorage = Arc.container().select(AuthorizationPolicyStorage.class).get();\n                final MethodDescription securedMethod;\n                if (authorizationPolicyStorage.requiresAuthorizationPolicy(desc.invokedMethodDesc())) {\n                    securedMethod = desc.invokedMethodDesc();\n                } else if (authorizationPolicyStorage.requiresAuthorizationPolicy(desc.fallbackMethodDesc())) {\n                    securedMethod = desc.fallbackMethodDesc();\n                } else {\n                    throw new IllegalStateException(\n                            \"\"\"\n                                    @AuthorizationPolicy annotation placed on resource method '%s#%s' wasn't detected by Quarkus during the build time.\n                                    Please consult https://quarkus.io/guides/cdi-reference#bean_discovery on how to make the module containing the code discoverable by Quarkus.\n                                    \"\"\"\n                                    .formatted(desc.invokedMethodDesc().getClassName(),\n                                            desc.invokedMethodDesc().getMethodName()));\n                }\n                return List.of(new EagerSecurityHandler(null, false, securedMethod));\n            }\n            return List.of();\n        }\n    }\n\n    public static final class HttpPermissionsAndSecurityChecksCustomizer implements HandlerChainCustomizer {\n\n        private volatile SecurityCheckInfo securityCheckInfo;\n\n        @Override","sourceCodeStart":192,"sourceCodeEnd":228,"githubUrl":"https://github.com/quarkusio/quarkus/blob/e1c734241f34c7919086ceb4c9262b4a58f6de44/extensions/resteasy-reactive/rest/runtime/src/main/java/io/quarkus/resteasy/reactive/server/runtime/security/EagerSecurityHandler.java#L192-L228","documentation":"At runtime, EagerSecurityHandler determines whether a resource method needs an @AuthorizationPolicy check by consulting the AuthorizationPolicyStorage populated at build time. If neither the invoked nor fallback method description is registered, the annotation was not seen during build (the class wasn't part of Jandex/bean discovery), so it throws IllegalStateException with a link to the CDI bean discovery docs.","triggerScenarios":"A resource method annotated with @AuthorizationPolicy lives in a module not discoverable at build time (no beans.xml, not indexed by Jandex — e.g. a plain jar dependency outside the application), or the annotation was added without rebuilding, or a proxy/fallback method mismatch.","commonSituations":"Placing resources in a shared library jar not indexed by Quarkus; adding @AuthorizationPolicy in a multi-module project where the module isn't a Quarkus-managed dependency; stale incremental builds.","solutions":["Make the module containing the resource discoverable: add a META-INF/beans.xml (bean-discovery-mode all) or add it as a Jandex-indexed dependency (jandex-maven-plugin)","Rebuild the application (./mvnw clean install) after adding the annotation","Move the resource class into the application or an indexed Quarkus extension module","Verify the method description matches — remove duplicated method signatures that could confuse invoked vs fallback method resolution"],"exampleFix":"// library pom: make it indexable\n<plugin>\n  <groupId>io.smallrye</groupId>\n  <artifactId>jandex-maven-plugin</artifactId>\n  <executions><execution><goals><goal>jandex</goal></goals></execution></executions>\n</plugin>\n","handlingStrategy":"validation","validationCode":"// verify the resource module is Jandex-indexed before relying on @AuthorizationPolicy\nboolean indexed = new File(moduleDir, \"META-INF/jandex.idx\").exists()\n        || new File(moduleDir, \"META-INF/beans.xml\").exists();\nif (!indexed) throw new IllegalStateException(\"Module must be Jandex-indexed for @AuthorizationPolicy\");","typeGuard":null,"tryCatchPattern":"try {\n    securedEndpointCall();\n} catch (IllegalStateException e) {\n    if (e.getMessage().contains(\"@AuthorizationPolicy\")) {\n        // fix bean discovery: add jandex index / beans.xml and rebuild\n    } else throw e;\n}","preventionTips":["Index all library modules containing resources (jandex-maven-plugin or beans.xml)","Clean rebuild after adding security annotations","Keep resource classes in modules that participate in Quarkus bean discovery"],"tags":["quarkus","security","cdi","bean-discovery","jandex"],"backgroundTag":"annotation-not-discovered-at-build-time","analyzedSha":"e1c734241f34c7919086ceb4c9262b4a58f6de44","analyzedAt":"2026-09-05T17:01:29.979Z","contentChangedAt":"2026-09-05T17:01:29.979Z","schemaVersion":2},"datasetVersion":"2026-09-12T22:17:10.623Z"}